[FIX] pad, pad_project: mark pad output as markup-safe

And remove the now unnecessary `t-raw` to embed it.

addons/pad/models/pad.py

@@ -7,6 +7,7 @@ import re
 import string
 
 import requests
+from markupsafe import Markup
 
 from odoo import api, models, _
 from odoo.exceptions import UserError
@@ -99,7 +100,7 @@ class PadCommon(models.AbstractModel):
                     if mo:
                         content = mo.group(1)
 
-        return content
+        return Markup(content)
 
     # TODO
     # reverse engineer protocol to be setHtml without using the api key

addons/pad_project/views/project_portal_templates.xml

@@ -23,7 +23,7 @@
                     </div>
                 </t>
                 <t t-else="">
-                    <div class="py-1 px-2 bg-100 small" t-raw="task._get_pad_content()"/>
+                    <div class="py-1 px-2 bg-100 small" t-esc="task._get_pad_content()"/>
                 </t>
             </t>
             <t t-else="">